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The privacy amplification term, of which the lower bound needs to be estimated with the decoy- 
state method, plays a positive role in the secure key rate formula for decoy-state quantum key 
distribution. In previous work, the yield and the bit error rate of single-photon state are estimated 
separately to gain this lower bound. In this work, we for the first time take the privacy amplification 
term as a whole to consider this lower bound. The mathematical description for the correlation 
between the yield and the bit error rate of single-photon state is given with just two unknown 
variables. Based on this, we obtain the global estimation of this lower bound for both BB84 protocol 
and measurement-device-independent protocol. The results of numerical simulation show that the 
global estimation can significantly improve the performance of quantum key distribution. 

PACS numbers: 03.67.Dd, 42.81.Gs, 03.67.Hk 


I. INTRODUCTION 

Quantum key distribution (QKD) based on the laws 
of quantum physics can theoretically present an uncondi¬ 
tionally secure communication [ll-l3|. However, there is a 
gap between its theory and practice due to the imperfec¬ 
tion in real-life implementation. Particularly, the eaves¬ 
dropper (Eve) can launch attacks aiming at the imperfect 
single-photon source and the limited detector efficiency 
in practical QKD system M- By utilizing the decoy- 
state method |10l - [l^ . the practical QKD setups with an 
imperfect single-photon source can be still secure. 

To deal with the threat coming from the detectors [l^ , 
several approaches have been proposed. One is device¬ 
independent QKD (DI-QKD) [IJ of which the security is 
based on the violation of a Bell inequality. However, DI- 
QKD con not apply to existing practical system because 
a loophole-free Bell test at the moment is still unavail¬ 
able. Another one is measurement-device-independent 
quantum key distribution (MDI-QKD) [I^ [l^ based on 
the idea of entanglement swapping which can remove all 
detector side channel attacks. 

The security of BB84 protocol with imperfect devices 
is analyzed in [i^a The security of MDI-QKD proto¬ 
col is researched in |l6l. 1^ . . Some useful formulas are 

given to calculate the secure key rate for practical BB84 
protocol and MDI-QKD protocol. The privacy amplifi¬ 
cation term makes a positive contribution in these secure 
key rate formulas and it can not be measured in the ex¬ 
periment. In asymptotic case, the yield of single-photon 
state is basis independent . Then the privacy am¬ 

plification term can be calculated in just one basis. 

In previous work [^ . the lower bound of this term 
is obtained by estimating the lower bound of the yield 
Yi of single-photon state and the upper bound of the 
bit error rate ei of single-photon state separately. The 
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lower bound of the yield Yi is estimated from the gain 
equations while the upper bound of the bit error rate 
ei is estimated from the quantum bit error rate (QBER) 
equations. The yield Yi of Tphoton state existing in both 
the gain equations and the QBER equations is the link 
between the estimation of lower bound of Yi and that of 
upper bound of ei. When Yi is one certain value, the 
minimum of Yi is reached. But the maximum of ei may 
be reached as Yi is another certain value. That is to 
say, the lower bound of Yi and the upper bound of Ci 
may not be simultaneously reached. Thus, the separate 
estimation can just bring a lower bound of the privacy 
amplification term instead of the minimum. 

Inspired by Wang’s method [13, lH, HE HI]: give a 

mathematical description of the correlation between Yi 
and Cl with just two unknown variables. In particular, we 
will show that globally estimating the lower bound of the 
privacy amplification term is equal to finding the mini¬ 
mum of a bivariate continuous function in a closed area. 
Thus the minimum of the privacy amplification term can 
be attained with the global estimation and higher secure 
key rate can be achieved. 

The article is organized as follows. Section |IT] intro¬ 
duces the global estimation of the lower bound of the pri¬ 
vacy amplification term for BB84 protocol. The global 
estimation for MDI-QKD protocol will be discussed in 
section nni We conclude our work in section IlYl 


II. THE GLOBAL ESTIMATION OF THE 
LOWER BOUND OF THE PRIVACY 
AMPLIFICATION TERM FOR BB84 PROTOCOL 

The privacy amplification term for BB84 protocol is 
given by Yi[l —iL(ei)], where Yi and ei are, respectively, 
the yield and the bit error rate of single-photon state. 
Here in this section, firstly we mathematically character¬ 
ize the correlation between Yi and ei. Then the minimum 
of Yi[l — iJ(ei)] is given with the method of global es¬ 
timation. Lastly, the numerical simulation is performed 
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to make a comparison in performance of QKD protocol 
between the global estimation and the separated estima¬ 
tion. 

A. The correlation between Yi and ei 

Given a weak coherent state source which sends three 
different kinds of optical pulses with intensities w, v and 
fi {0 = uj < V < fi), the overall gains which mean the 
probability for Bob to obtain a detection event in one 
pulse are given by following three equations, 


amplification term is influenced by infinite variables. It 
is computationally infeasible to find the minimum of a 
function with infinite variables. Fortunately, we find a 
way to reduce the number of unknown variables to two 
inspired by Wang’s method [l^, [11| • We define a state of 
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where Qi, and Yi are, respectively, the overall gain with 
intensity v (v £ {w, v, p}) and the yield of i-photon state. 

We denote to be the overall QBER with intensity i/, 
Ci to be the bit error rate of i-photon state. The overall 
QBER equations can be given by 


Then equation © and equation (jS)) can be rewritten as 
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It is important to note that Yq is equal to the gain 
when Alice does not send any optical pulse, which in¬ 
cludes the detector dark count and other background 
contributions. As the background is random, we assume 
that E^ = eo = 0.5. 

As three equations can only fix three variables, we tem¬ 
porarily take Yi {i > 3) as known variables. Then three 
gain equations can be solved according to Cramer’s rule. 
Yi is given by 
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Similarly, eiYi can be gained by 
61^1 = 
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From equation © and equation®, we can get that 
there are infinite variables Yi (i > 3) simultaneously in¬ 
fluencing the values of Yi and eiYi. Then the privacy 


Thus Yi and eiYi is determined by the gains and the 
QBERs which can be measured in the experiment except 
the yield and the bit error rate of state p. State p is 
the link between the calculations of Yi and CiYi. The 
yield Yp of state p as a unknown variable simultaneously 
influences the estimations of both Yi and ei. In [s^, Yp 
is set to 0 to get the lower bound of Yi while Cp and Yp 
are both set to 1 to get the upper bound of ei. Thus the 
contradiction that Yp cannot be simultaneously 0 and 1 
emerges. 

The quantity of the privacy amplification term is 
Yi[l — 7Y(ei)], which is a bivariate continuous function 
of Yp and Cp. The minimum of the continuous func¬ 
tion on the closed area can be attained. This is one 
reason why we should consider the global lower bound of 
Yi[l —iY(ei)] instead of calculating the lower bound of Yi 
and the upper bound of ei separately. In previous work 
[mil, 1^ . [3l| , the lower bound of Yi is gained by utiliz¬ 
ing the gain equations. In fact, Yi also exists in QBER 
equations where the information of Yi is not extracted. 
This is another motivation that the global lower bound 
of Yi[l — i^(el)] should be considered. 
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B. The global lower bound of Yi[l — H{ei)\ 


According to previous work pm, [Mm , the most 
accurate estimations of Yi and ei are given by 


Yi > = 


— v) 
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According to the corollary in appendix, the global lower 
bound of Yi[l — H{ei)] can be gained by 


TABLE I. List of parameters for numerical simulation 


eo 

/ 

Pd 

ed 

0.5 

1.16 

3 X 10”'" 

1.5% 


and equation (IT71) 1 are shown in figure [H The ratios of 
the secure key rates computed with two methods (sepa¬ 
rate estimation and global estimation) to the asymptotic 
limit are shown in figure [3] From the results, we can 
see tighter estimations of Yi and ei are gained with the 
method of global estimation. Thus, higher secure key 
rates are achieved. 


n(l - iL(ei)) > (Yi^ + e)[i - 

0 =—^ - - eoYo) 

-Ar(e"A„Q, - eoYo)] > 0. (15) 

To make a clear comparison, we denote (Y/^, ef) as the 
point where the minimum is achieved. Corresponding to 
equation (IT^ and equation (fT4|) , Y/^ and ef are given by 




= Yi + 0, 

Yl^ + e' 


(16) 

(17) 


Here 9 can be considered the information of Yi coming 
from the QBER equations, which is abandoned for the 
separate estimation. By globally considering the lower 
bound of the privacy amplification term, we successfully 
extract it. 



FIG. 1. (Color online) The ratio of the estimation of Yi to the 
asymptotic limit calculated with the infinite-intensity decoy- 
state method vs the total channel transmission loss for three- 
intensity decoy-state BB84 protocol. We set v = 0.1, /i = 0.5 
for decoy state and signal state, respectively. 


C. Numerical simulation for BB84 protocol 

With the observed gains and error rates, the final se¬ 
cure key rate can be calculated Pby 

R>pXi[^-H{,ei)]-Q^fH{E^), (18) 

where Pi is the probability that Alice sends a single¬ 
photon state pulse corresponding to signal state /x; / is 
the error correction inefficiency; E[{x) = —a;log 2 (x) —(1 — 
a;)log 2 (l—x) is the binary Shannon entropy function. For 
a fair comparison, we use the same parameters in [M . [M| 
summarized in table [H For simplicity, the detection effi¬ 
ciency is put to the overall channel transmission, hence 
we only need to assume the 100% detection efficiency at 
Bob’s side. 

The ratios of the estimations of Yi with two methods 
(equation (IT^ and equation (IT6l) ) to the asymptotic limit 
calculated with the infinite-intensity decoy-state method 
are shown in figure [1] The ratios of the asymptotic limit 
of Cl to the estimations with two methods (equation (fHl) 



FIG. 2. (Golor online) The ratio of the asymptotic limit cal¬ 
culated with the infinite-intensity decoy-state method to the 
estimation of ei vs the total channel transmission loss for 
three-intensity decoy-state BB84 protocol. We set v = 0.1, 
fj, = 0.5 for decoy state and signal state, respectively. 
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FIG. 3. (Color online) The ratio of the secure key rate cal¬ 
culated with the three-intensity decoy-state method to the 
asymptotic limit calculated with the infinite-intensity decoy- 
state method vs the total channel transmission loss for decoy- 
state BB84 protocol. We set v = 0.1, p = 0.5 for decoy state 
and signal state, respectively. 


III. THE GLOBAL ESTIMATION OF THE 
LOWER BOUND OF THE PRIVACY 
AMPLIFICATION TERM FOR MDI-QKD 
PROTOCOL 


For MDI-QKD protocol, the secure key rate is gained 

M by 




(19) 


For MDI-QKD protocol, the gain and QBER when Al¬ 
ice (Bob) sends a certain pulse with intensity qa {qt) can 
be given by 
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where Yij and e^- is the yield and the bit error rate when 
Alice (Bob) sends an f-photon (j-photon) state pulse. 

Given two weak coherent state sources which send 
three different kinds of optical pulses with intensities 
(0 = uJa < Va < p-a) and (0 = Wfe < Uh < fib), we 
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where ph is the probability that Alice and Bob simulta¬ 
neously send single-photon state pulses corresponding to 
signal state in z basis; and E^^^^ are the gain and 

QBER when Alice and Bob simultaneously send signal 
state pulses; Y^^ and are the yield in Z basis and the 
bit error rate in X basis when Alice and Bob simultane¬ 
ously send single-photon state pulses. 

The variable values in (ttH) can be measured in the 
experiment except and So the major task in 

the calculation of secure key rate is estimating the lower 
bound of Yfi[l — H{efi)]. In previous work, to get the 
lower bound of — H{efi)], the lower bound of Yf^ 
and the upper bound of are calculated separately. 

In fact, y/i is equal to Yf[ in asymptotic setting ac¬ 
cording to [ 23 . As a result, we will not temporarily dis¬ 
tinguish the basis of Yu and en. We will consider the 
lower bound of Yii[l — H{eii)] as a whole. 

Similarly, in this section we will firstly introduce the 
mathematical description of the correlation between Yu 
and eii. Then the global lower bound of Yii[l — H{eii)] 
is calculated. Lastly, the results of numerical simulation 
will be given. The following work is on basis of the three- 
intensity decoy-state MDI-QKD protocol [^ . 


where ,^2 {fii G {fia, Va},ti2 G {fib, Vb}) is achieved by 
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Handf 


Yi,i = Y,\+ ^ 

ii+j)>4 
,i-l ,,i-l 


T Y 


i\jl{fla -Va){flb -VbY 

= '^''a^Eb~''4>b{fla - Va) + fY~^ vl~^ Va{flb “ Vb) 

-v'aY^vl~^ [flaflb - VaVb) > 0 , 


(27) 


yL _ 
111 — 


- VaVb) 


{f4a - Va){flb - Vb) 


VaVb 


QvaVb 


e('"“+’''’)ua(^f, -Uf,)^ e(/Xa -Ua)y^ ^ 

^l^aVb bjUaMbh 


flaVb 


Vaflb 


(28) 


Similarly, en can be solved from the corresponding 
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QBER equations, 

eiiYn = (eiiYii)^ + Y] 
(i+j)>4 

1 


Yi^j Y-i j 


ilj'-iHa - Va)if4b - Vb) 


,(29) 


(eiiFii)^ = 


{^^a - Va)itJ-b - Vb) 


- VaVb) 


VaVb 


A p e^f^-^+^^^Vaiflb-Vb) ~ ^ 

^VaVb-^VaVb 
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Va^J-b 
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(30) 


e {tJ'a,Va},fJ '2 G {tJ-b,Vb}) is achieved by 






e ''^E<^„^b2<5i^aM2 - e (31) 


It is easy to verify that is positive when (i+j) > 4. 
So we can define a state of which the density operator is 
^ S .b-!(M.-SU-^b)n (N) (*l ® b') 01), where U 

(z+j)>4 

is equal to E 

p+j)>4 

Then equation (l27l) and equation (l29ll can be rewritten 


To make a clear comparison, we denote (T/f, ef^) as the 
point where the minimum is attained. Corresponding to 
equation (l28)l and equation (l34)l . and efi is given by 




y^i = 


pU pL 

a _ 

Cii — 


YA+5' 


(36) 

(37) 


C. Numerical simulation for MDI-QKD protocol 

Numerical simulations are performed with the param¬ 
eters in table ID The ratios of the estimations of Yu 
with two methods (equation (l28l) and equation (l36l) ') to 
the asymptotic limit obtained with the infinite-intensity 
decoy-state method are shown in figure IH The ratios of 
the asymptotic limit of en to the estimations with two 
methods (equation (IMll and equation (|37)) 1 are shown in 
figure El The ratios of the secure key rates calculated 
with two methods (separate estimation and global esti¬ 
mation) to the asymptotic limit are shown in figure |6l 
From the results, we can see tighter estimations of Yu 
and eii are gained with global estimation. Thus, higher 
secure key rates are reached. 


Yu=Y^\+TlY^, (32) 

eiiTn =(eiiyii)^ + (33) 

where Y^ and is the yield and the bit error rate of 
state '0- 

Thus Yu and eu is linked by the state 0. Yii(l — 
H{eu)) is a bivariate continuous function with two pa¬ 
rameter variables and e^. The lower bound of Yu can 
be gained by setting Y^ to 0 while the upper bound of eu 
can be gained by setting and to 1. Thus the lower 
bound of Fii(l — H{eu)) can not be reached with the 
separate estimation. The minimum of Fii(l — H{eu)) 
can be attained with the global estimation. 



B. The global lower bound of Fii(l — H{eii)) 

In [ 2 ^, the lower bound of Fn is given in equation (l28l) 
by setting the last term in equation ([27|) to 0. The upper 
bound of eii is given by setting the term etjYij (i+j) > 2 
of to 0, 


FIG. 4. (Color online) The ratio of the estimation of Fn 
to the asymptotic limit calculated with the infinite-intensity 
decoy-state method vs the total channel transmission loss for 
three-intensity decoy-state MDI-QKD protocol. We set Va = 
Vb = 0.1, fj-a = iJ-b = 0.5 for decoy states and signal states, 
respectively. 


eii < Cii = 


VaVbY/{ 


(34) 


IV. CONCLUSION 


According equations (1^ [33] and [34]) and corollary in 
appendix, the global lower bound of Fii(l — i7[eii]) is 
given by 

Fn[l - i7(en)]> {Y,\ + J)[l - (35) 

s= efiEl; - (eiiFn)^ > 0. 


The global estimations of the privacy amplification 
term for both BB84 protocol and MDI-QKD protocol 
have been researched in this paper. Conventional sepa¬ 
rate estimation will abandon the information of the yield 
of single-photon state in QBER equations. With the 
global estimation of the privacy amplification term, this 
information has been extracted and the minimum of the 
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FIG. 5. (Color online) The ratio of the asymptotic limit of 
eii calculated with the infinite-intensity decoy-state method 
to the estimation vs the total channel transmission loss for 
three-intensity decoy-state MDI-QKD protocol. We set Va = 
Vb = 0.1, i-ia = IJ'b = 0.5 for decoy states and signal states, 
respectively. 



FIG. 6. (Color online) The ratio of secure key rate calculated 
with the three-intensity decoy-state method to the asymptotic 
limit calculated with the infinite-intensity decoy-state method 
vs the total channel transmission loss for decoy-state MDI- 
QKD protocol. We set Va = Vb = 0.1, Ha = fJ-b ~ 0.5 for 
decoy states and signal states, respectively. 


privacy amplification term is achieved. Compared with 
separate consideration, more accurate estimations of the 
yield and the bit error rate of single-photon state are 
gained, which thus significantly improve the performance 
of the quantum key distribution for both BB84 protocol 
and MDI-QKD protocol. Additionally, more accurate 
separate estimation will contribute to more smaller do¬ 
main of the bivariate function which thus can further help 
to obtain a tighter global estimation. 


APPENDIX 


Theorem: For the bivariate continuous function 
f{x,y) = {A + Cy)[l-H{^^)] (A > 0,6- > 0) 
with the definition domain {(a;,j/):0<a;<l,0<j/< 
1, < 0.5}, the minimum can be attained on the 

border. 

proof: Firstly, the partial derivatives of function 
f(x,y) are given by 


fx 


-{A + Cy)H{ 


B + Cxy 
{A + Cy) 


Cy 

A + Cy^ 


(38) 


fy =C[1 - Hi 


B + Cxy 


A + Cy 
{ACx - BC) 

{A + Cyf ■ 


-iA^Cym^^y 


A + Cy 


(39) 


If there is an extreme point (xo,yo) (0 < a;o < 1,0 < 
yo < 1), then Hi ^^^Jy )' has to be 0 from the restrict 
fx = 0. Combine the restrict fy = 0, we can get C[1 — 
H ()] “ This is in contradiction with our initial 
assumption. 

Function fix,y) for a fixed y is a decreasing func¬ 
tion with parameter variable x. So the minimum can 
be reached where a; is 1. So this problem is converted to 
searching the minimum of univariate continuous function 
9{y) = {A + y)[l-H{^)]{0 <y <C). Calculating the 
derivative function of giy), we can find 


gy=l-Hi^)-{A + y)Hi 
~r y 

= l + OlogO + ( 

A+y A+y 
,A-B^^ ,A-B^ 


A + y 


B + y‘ 




B + y y [A — B) 
A + y iA + yf 


A-B 
A + y 


)log( 


A-B 
A + y 


) 


(40) 


As we assume <1/2, then gy < 0. That is to say, 
gy is a decreasing function with parameter variable y. 

Corollary: For the bivariate continuous function 
fix,y) = iA + Cy)[l-Hi^^)] (A > 0,^7 > 0) 
with the definition domain {ix,y) : 0 < a; < 1,0 < 
y < 1, < 0.5, (B + Ca:y) < D,iA + Cy) > E}, 

the nonzero minimum can be obtained in the following 
three cases. 

case 1: when [D — B) < C and {D — B) > (A —A), the 
minimum is /(l,^^) = [A + D - B)[l - H 

case 2: when [D — B) < C and {D — B) < {E — A), 
the minimum is /(fff, ^) = E[1 - 

case 3: when (D — B) >= C, the minimum is f(l, 1) = 
{A + C)[1-H{^)]. 

proof: If we set (B + Cxy) = D, the function f{x,y) 
is converted to an univariate continuous increasing func¬ 
tion (A - 1 - Cy)[\ — H ( ji^y^Qy )] ■ Then it is easy to verify 
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the correctness of corollary combining with the proof of 
theorem. 
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